@effect-agent/platform-cloudflare 0.1.0-beta.94 → 0.1.0-beta.96

package/dist/Alarm.d.mts

@@ -1,6 +1,6 @@
 import { DurableObjectContext } from "./CloudflareBindings.mjs";
-import { o as CloudflareDurableRuntimeConfig } from "./CloudflareConfig-f3CqTel1.mjs";
-import { Cause, Context, Deferred, Effect, Layer, Option, Schema } from "effect";
+import { s as CloudflareDurableRuntimeConfig } from "./CloudflareConfig-DKXGo8L3.mjs";
+import { Cause, Context, DateTime, Effect, Layer, Option, Schema, Scope } from "effect";
 import { DurableBindingFailure } from "effect-agent/agent-registration";
 import { DurableAgentRuntime, DurableWorkerFailure } from "effect-agent/durable-agent-runtime";
 import { SubmissionLedger } from "effect-agent/submission-ledger";
@@ -75,7 +75,7 @@ declare const MaintenancePassReport_base: Schema.Class<MaintenancePassReport, Sc
 /** What one maintenance pass did — auditable evidence mirroring `NodeDurableHost`'s report. */
 declare class MaintenancePassReport extends MaintenancePassReport_base {}
 /** Fault boundaries around every maintenance-owned durable mutation. */
-type ThreadMaintenanceFailpointLocation = "maintenance:dirty:before" | "maintenance:dirty:after" | "maintenance:mutation:armed" | "maintenance:mutation:finished" | "maintenance:ensure:before" | "maintenance:ensure:after" | "maintenance:begin:before" | "maintenance:begin:after" | "maintenance:select:before" | "maintenance:select:after" | "maintenance:finish:before" | "maintenance:finish:after";
+type ThreadMaintenanceFailpointLocation = "maintenance:dirty:before" | "maintenance:dirty:after" | "maintenance:mutation:armed" | "maintenance:mutation:finished" | "maintenance:ensure:before" | "maintenance:ensure:after" | "maintenance:begin:before" | "maintenance:begin:after" | "maintenance:select:before" | "maintenance:select:after" | "maintenance:binding-retry:before" | "maintenance:binding-retry:after" | "maintenance:retry:before" | "maintenance:retry:after" | "maintenance:finish:before" | "maintenance:finish:after";
 type ThreadMaintenanceFailpointHandler = (location: ThreadMaintenanceFailpointLocation) => Effect.Effect<void>;
 declare const ThreadMaintenanceFailpoint_base: Context.ServiceClass<ThreadMaintenanceFailpoint, "@effect-agent/platform-cloudflare/ThreadMaintenanceFailpoint", {
   readonly hit: ThreadMaintenanceFailpointHandler;
@@ -92,6 +92,8 @@ declare class ThreadMaintenanceFailpoint extends ThreadMaintenanceFailpoint_base
  * `invalidate`, `prepareGeneration` and `pendingDeadline` must be bounded local operations.
  * `prepareGeneration` durably invalidates a scan only when its generation changes; repeated
  * calls must preserve partial scan progress. It runs with no source mutation in flight.
+ * Use this gate only for publication required before dependent native execution. Independent
+ * UI relays and outboxes belong to ThreadHostMaintenance.
  * `drain` performs bounded delivery and persists retries before returning. A pending deadline
  * defers runtime recovery/Attempts, allowing committed host publications to drain first.
  * Unexpected hook failures leave the prearmed generation for retry. Hooks acquire per-call
@@ -110,33 +112,46 @@ declare class ThreadPublication extends ThreadPublication_base {
   static readonly layer: Layer.Layer<ThreadPublication, never, never>;
 }
 /**
- * Host-assembled message recovery, supplied by ThreadObject.layer even when the application
- * rebuilds ThreadMaintenance. These obligations outlive source Runs and never defer a ready
- * source Attempt while a destination is processing an accepted message.
+ * Host-assembled native message recovery. The driver bounds each actual Claim and persists its
+ * timeout/retry before this pump returns. Do not add a second timer starting at batch selection:
+ * local Claim setup may take time, and expiration still owes the driver's local retry commit.
  */
 declare const ThreadMessageDelivery: Context.Reference<{
-  readonly drain: Effect.Effect<void, DurableAlarmError>;
-  /** Drain inserts and due retries during source work, finishing the bounded wave on completion. */
-  readonly drainUntil?: (finished: Deferred.Deferred<void>) => Effect.Effect<void, DurableAlarmError>;
+  readonly drainUntil: (sourceFinished: Effect.Effect<void>, dispatchUntil: DateTime.Utc) => Effect.Effect<void, DurableAlarmError, Scope.Scope>;
   readonly pendingDeadline: Effect.Effect<Option.Option<number>, DurableAlarmError>;
 }>;
 /**
- * Application obligations sharing this Object's alarm. The deadline read is local and
- * read-only. Drain beside the native Attempt and always finish one initial bounded wave,
- * even when `finished` was already signalled. Then stop starting new waves on that signal
- * and finish the bounded current wave before returning. Native maintenance joins that work
- * before acknowledging a generation. Mutations use the same ThreadMutationGate; hooks never
- * write the raw alarm slot. Pending host work does not defer a ready model Attempt.
+ * Application obligations sharing this Object's alarm. Admit one initial external wave even on
+ * a caught-up pass, then respond to wakes while native work runs. sourceFinished closes only
+ * admission of NEW external waves. Keep local admission/hub subscriptions in the supplied event
+ * Scope until maintenance tears it down; do not scope them to sourceFinished or to this Effect.
+ * No deadline sleeps or automatic retry loops. Return after already-admitted waves finish.
+ *
+ * Declare a finite whole-wave allowance (1..300000ms): maximum for parallel lanes, sum for
+ * sequential operations. Admit a wave only if its allowance fits before dispatchUntil. Later
+ * arrivals cannot renew the retirement window. Maintenance bounds the join after sourceFinished,
+ * interrupts and joins event Scope, then reads local deadlines under the mutation gate.
+ *
+ * Setup and pendingDeadline are bounded local operations. Persist claims/envelopes before
+ * dispatch; interrupted waits leave exact retries/receipts recoverable. Cancellation is local,
+ * not remote rollback. Retry accounting is unchanged. Network waits/finalizers must be
+ * interruptible; short local atomic commits may be uninterruptible. Hooks never write the raw
+ * alarm slot. Required native publication gates belong to ThreadPublication.
  */
 declare const ThreadHostMaintenance: Context.Reference<{
+  readonly dispatchTimeoutMillis: number;
+  readonly drainUntil: (sourceFinished: Effect.Effect<void>, dispatchUntil: DateTime.Utc) => Effect.Effect<void, DurableAlarmError, Scope.Scope>;
   readonly pendingDeadline: Effect.Effect<Option.Option<number>, DurableAlarmError>;
-  readonly drainUntil: (finished: Deferred.Deferred<void>) => Effect.Effect<void, DurableAlarmError>;
 }>;
 /** @internal A committed source operation must not become a failed operation because delivery failed. */
 declare const publishCommitted: Effect.Effect<void, never, ThreadPublication>;
 declare const ThreadMutationGate_base: Context.ServiceClass<ThreadMutationGate, "@effect-agent/platform-cloudflare/internal/ThreadMutationGate", {
   readonly withMutation: <A, E, R>(body: Effect.Effect<A, E, R>,
-  /** Indexed host work has its own durable deadline and does not invalidate ledger recovery. */
+  /**
+   * Native admission, approval, abort and unknown resolution keep the default true.
+   * Projection/relay/reply receipt-only bookkeeping must use false: its local durable
+   * pendingDeadline owns scheduling without creating native recovery debt.
+   */
   options?: {
     readonly invalidatesRecovery: boolean;
   }) => Effect.Effect<A, E | DurableAlarmError, R>;
@@ -152,7 +167,7 @@ declare class ThreadMutationGate extends ThreadMutationGate_base {
 }
 type MaintenancePassFailure = DurableWorkerFailure | DurableBindingFailure | DurableAlarmError | ThreadProjectionError;
 declare const ThreadMaintenance_base: Context.ServiceClass<ThreadMaintenance, "@effect-agent/platform-cloudflare/ThreadMaintenance", {
-  /** One idempotent maintenance pass; failures propagate so workerd retries the alarm. */
+  /** One idempotent pass; failures propagate after durably scheduling bounded recovery. */
   readonly pass: Effect.Effect<MaintenancePassReport, MaintenancePassFailure>;
   /**
    * Constructor gate: initialize/inspect only the O(1) maintenance record and ensure a dirty
@@ -175,9 +190,13 @@ declare const ThreadMaintenance_base: Context.ServiceClass<ThreadMaintenance, "@
  *    alarm takes an O(1) path without recovery, ledger scans, or canonical-history reads.
  * 2. Recovery strictly precedes a new claim. One head Attempt advances the lane and requests
  *    a safe yield after ten minutes. The whole event has a fourteen-minute cooperative timeout.
- * 3. The final transaction acknowledges only the generation observed at pass start. A racing
+ * 3. Auxiliary dispatch and listeners belong to the event Scope. After native completion,
+ *    stop new external waves, join native delivery through its driver-owned Claim deadline,
+ *    and bound host/backfill work by explicit allowances before closing and joining Scope.
+ *    Ordinary auxiliary setup failures are reported after the one native opportunity.
+ * 4. The final transaction acknowledges only the generation observed at pass start. A racing
  *    mutation therefore remains `dirty > processed` and retains its atomically-established alarm.
- * 4. Stable external waits acknowledge and clear. Autonomous retry, indeterminate, and lease
+ * 5. Stable external waits acknowledge and clear. Autonomous retry, indeterminate, and lease
  *    recovery states leave their generation dirty and retain bounded backoff rearming.
  */
 declare class ThreadMaintenance extends ThreadMaintenance_base {

package/dist/Alarm.mjs

@@ -1,11 +1,11 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { DurableObjectContext } from "./CloudflareBindings.mjs";
-import { CloudflareDurableRuntimeConfig } from "./CloudflareConfig.mjs";
+import { AuxiliaryDispatchMillis, CloudflareDurableRuntimeConfig } from "./CloudflareConfig.mjs";
 import { r as safeCauseMessage } from "./boundary-BguazVkh.mjs";
-import { Cause, Clock, Context, DateTime, Deferred, Effect, Exit, Fiber, Layer, Option, Random, Ref, Schema, Semaphore, Stream } from "effect";
+import { Cause, Clock, Context, DateTime, Deferred, Effect, Exit, Fiber, Layer, Option, Random, Ref, Schema, Scope, Semaphore, Stream, Struct } from "effect";
 import "effect-agent/agent-registration";
 import { DurableAgentRuntime } from "effect-agent/durable-agent-runtime";
-import { ThreadId } from "effect-agent/identifiers";
+import { SubmissionId, ThreadId } from "effect-agent/identifiers";
 import { SubmissionLedger } from "effect-agent/submission-ledger";
 import { ThreadProjectionMaintenance, drainDue } from "effect-agent/thread-projection-maintenance";
 import { SqlClient } from "effect/unstable/sql/SqlClient";
@@ -109,25 +109,36 @@ var ThreadPublication = class extends Context.Service()("@effect-agent/platform-
 	});
 };
 /**
-* Host-assembled message recovery, supplied by ThreadObject.layer even when the application
-* rebuilds ThreadMaintenance. These obligations outlive source Runs and never defer a ready
-* source Attempt while a destination is processing an accepted message.
+* Host-assembled native message recovery. The driver bounds each actual Claim and persists its
+* timeout/retry before this pump returns. Do not add a second timer starting at batch selection:
+* local Claim setup may take time, and expiration still owes the driver's local retry commit.
 */
 const ThreadMessageDelivery = Context.Reference("@effect-agent/platform-cloudflare/ThreadMessageDelivery", { defaultValue: () => ({
-	drain: Effect.void,
+	drainUntil: () => Effect.void,
 	pendingDeadline: Effect.succeed(Option.none())
 }) });
 /**
-* Application obligations sharing this Object's alarm. The deadline read is local and
-* read-only. Drain beside the native Attempt and always finish one initial bounded wave,
-* even when `finished` was already signalled. Then stop starting new waves on that signal
-* and finish the bounded current wave before returning. Native maintenance joins that work
-* before acknowledging a generation. Mutations use the same ThreadMutationGate; hooks never
-* write the raw alarm slot. Pending host work does not defer a ready model Attempt.
+* Application obligations sharing this Object's alarm. Admit one initial external wave even on
+* a caught-up pass, then respond to wakes while native work runs. sourceFinished closes only
+* admission of NEW external waves. Keep local admission/hub subscriptions in the supplied event
+* Scope until maintenance tears it down; do not scope them to sourceFinished or to this Effect.
+* No deadline sleeps or automatic retry loops. Return after already-admitted waves finish.
+*
+* Declare a finite whole-wave allowance (1..300000ms): maximum for parallel lanes, sum for
+* sequential operations. Admit a wave only if its allowance fits before dispatchUntil. Later
+* arrivals cannot renew the retirement window. Maintenance bounds the join after sourceFinished,
+* interrupts and joins event Scope, then reads local deadlines under the mutation gate.
+*
+* Setup and pendingDeadline are bounded local operations. Persist claims/envelopes before
+* dispatch; interrupted waits leave exact retries/receipts recoverable. Cancellation is local,
+* not remote rollback. Retry accounting is unchanged. Network waits/finalizers must be
+* interruptible; short local atomic commits may be uninterruptible. Hooks never write the raw
+* alarm slot. Required native publication gates belong to ThreadPublication.
 */
 const ThreadHostMaintenance = Context.Reference("@effect-agent/platform-cloudflare/ThreadHostMaintenance", { defaultValue: () => ({
-	pendingDeadline: Effect.succeed(Option.none()),
-	drainUntil: () => Effect.void
+	dispatchTimeoutMillis: 1,
+	drainUntil: () => Effect.void,
+	pendingDeadline: Effect.succeed(Option.none())
 }) });
 const earliestDeadline = (left, right) => Option.isSome(left) ? Option.isSome(right) ? Option.some(Math.min(left.value, right.value)) : left : right;
 /** @internal A committed source operation must not become a failed operation because delivery failed. */
@@ -136,6 +147,19 @@ const publishCommitted = Effect.gen(function* () {
 	yield* publication.invalidate.pipe(Effect.andThen(publication.drain));
 }).pipe(Effect.catchCause((cause) => Cause.hasInterrupts(cause) ? Effect.interrupt : Effect.logError("Thread publication deferred after source commit", cause)));
 const MaintenanceGeneration = Schema.BigIntFromString.check(Schema.isGreaterThanOrEqualToBigInt(0n));
+var BindingRetry = class extends Schema.Class("BindingRetry")({
+	threadId: ThreadId,
+	submissionId: SubmissionId,
+	attempts: Schema.Natural,
+	notBefore: Schema.Finite,
+	reportedAt: Schema.Finite
+}) {};
+var MaintenanceRetry = class extends Schema.Class("MaintenanceRetry")({
+	generation: MaintenanceGeneration,
+	notBefore: Schema.Finite,
+	nativeOnly: Schema.Boolean,
+	stalls: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(30))
+}) {};
 /** Versioned, platform-private maintenance state stored through Durable Object KV. */
 var ThreadMaintenanceState = class extends Schema.Class("@effect-agent/platform-cloudflare/ThreadMaintenanceState")({
 	schemaVersion: Schema.Literal(1),
@@ -143,7 +167,10 @@ var ThreadMaintenanceState = class extends Schema.Class("@effect-agent/platform-
 	processed: MaintenanceGeneration,
 	nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
 	/** One physical-owner cursor; old single-lane records need no conversion. */
-	lastServedThreadId: Schema.optionalKey(ThreadId)
+	lastServedThreadId: Schema.optionalKey(ThreadId),
+	bindingRetries: Schema.optionalKey(Schema.Array(BindingRetry)),
+	/** Absent on older records. A newer mutation makes this retry obsolete. */
+	retry: Schema.optionalKey(MaintenanceRetry)
 }) {};
 const MAINTENANCE_STATE_KEY = "effect-agent:thread-maintenance:v1";
 const decodeMaintenanceState = Schema.decodeUnknownSync(ThreadMaintenanceState);
@@ -230,9 +257,13 @@ var ThreadMutationGate = class ThreadMutationGate extends Context.Service()("@ef
 *    alarm takes an O(1) path without recovery, ledger scans, or canonical-history reads.
 * 2. Recovery strictly precedes a new claim. One head Attempt advances the lane and requests
 *    a safe yield after ten minutes. The whole event has a fourteen-minute cooperative timeout.
-* 3. The final transaction acknowledges only the generation observed at pass start. A racing
+* 3. Auxiliary dispatch and listeners belong to the event Scope. After native completion,
+*    stop new external waves, join native delivery through its driver-owned Claim deadline,
+*    and bound host/backfill work by explicit allowances before closing and joining Scope.
+*    Ordinary auxiliary setup failures are reported after the one native opportunity.
+* 4. The final transaction acknowledges only the generation observed at pass start. A racing
 *    mutation therefore remains `dirty > processed` and retains its atomically-established alarm.
-* 4. Stable external waits acknowledge and clear. Autonomous retry, indeterminate, and lease
+* 5. Stable external waits acknowledge and clear. Autonomous retry, indeterminate, and lease
 *    recovery states leave their generation dirty and retain bounded backoff rearming.
 */
 var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effect-agent/platform-cloudflare/ThreadMaintenance") {
@@ -243,11 +274,6 @@ var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effe
 		const config = yield* CloudflareDurableRuntimeConfig;
 		const { ctx } = yield* DurableObjectContext;
 		const failpoint = yield* ThreadMaintenanceFailpoint;
-		/**
-		* Consecutive no-progress passes — an in-memory CACHE, not state: a fresh incarnation
-		* restarts at zero and merely re-arms sooner than a long-lived one would have.
-		*/
-		const stalls = yield* Ref.make(0);
 		const mutations = yield* ThreadMutationGate;
 		const publication = yield* ThreadPublication;
 		const projection = yield* ThreadProjectionMaintenance;
@@ -263,48 +289,74 @@ var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effe
 		const ensureAlarm = Effect.fn("ThreadMaintenance.ensureAlarm")(function* () {
 			yield* failpoint.hit("maintenance:ensure:before");
 			const now = yield* Clock.currentTimeMillis;
-			yield* runTransaction("ensure maintenance alarm", () => ctx.storage.transaction(async (transaction) => {
+			const retry = yield* runTransaction("ensure maintenance alarm", () => ctx.storage.transaction(async (transaction) => {
 				const { state, initialized } = await readMaintenanceState(transaction);
 				if (!initialized) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
-				if (state.dirty > state.processed) await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);
+				if (state.dirty > state.processed) await ensureTransactionAlarmBy(transaction, state.retry?.generation === state.dirty ? Math.max(now + minimumAlarmDelay, state.retry.notBefore) : now + config.wakeScanInterval);
+				return state.retry?.generation === state.dirty ? state.retry : void 0;
 			}));
 			const deadline = yield* pendingDeadline;
-			if (Option.isSome(deadline)) yield* runTransaction("ensure publication alarm", () => ctx.storage.transaction((transaction) => ensureTransactionAlarmBy(transaction, Math.max(now + minimumAlarmDelay, deadline.value))));
+			if (Option.isSome(deadline)) yield* runTransaction("ensure publication alarm", () => ctx.storage.transaction((transaction) => ensureTransactionAlarmBy(transaction, Math.max(now + minimumAlarmDelay, deadline.value <= now && retry !== void 0 && !retry.nativeOnly ? Math.max(deadline.value, retry.notBefore) : deadline.value))));
 			yield* failpoint.hit("maintenance:ensure:after");
 		});
-		const beginPass = Effect.fn("ThreadMaintenance.beginPass")(function* () {
+		const beginPass = Effect.fn("ThreadMaintenance.beginPass")(function* (observed) {
 			yield* failpoint.hit("maintenance:begin:before");
 			const now = yield* Clock.currentTimeMillis;
 			const result = yield* runTransaction("begin maintenance pass", () => ctx.storage.transaction(async (transaction) => {
 				const { state, initialized } = await readMaintenanceState(transaction);
+				observed.generation = state.dirty;
 				if (!initialized) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
-				if (state.processed >= state.dirty) {
-					await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
-					return {
-						_tag: "CaughtUp",
-						nonterminal: state.nonterminal
-					};
-				}
+				const retryAt = state.retry?.generation === state.dirty ? state.retry.notBefore : 0;
 				await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
+				if (state.processed >= state.dirty || retryAt > now) return {
+					_tag: "CaughtUp",
+					nonterminal: state.nonterminal
+				};
 				return {
 					_tag: "Actionable",
 					generation: state.dirty,
-					nonterminal: state.nonterminal
+					nonterminal: state.nonterminal,
+					stalls: state.retry?.generation === state.dirty ? state.retry.stalls : 0
 				};
 			}));
 			yield* failpoint.hit("maintenance:begin:after");
 			return result;
 		});
-		const rearmDelay = Effect.fn("ThreadMaintenance.rearmDelay")(function* (progressed) {
-			const priorStalls = yield* Ref.getAndUpdate(stalls, (count) => progressed ? 0 : count + 1);
-			if (progressed) return config.alarmBackoffBase;
-			const exponent = Math.min(priorStalls, 30);
-			const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** exponent);
-			const jitter = yield* Random.next;
-			const jittered = Math.ceil(backoff / 2 + backoff / 2 * jitter);
-			return Math.min(jittered, config.wakeScanInterval);
+		const backoffDelay = (priorStalls, jitter) => {
+			const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** Math.min(priorStalls, 30));
+			return Math.ceil(backoff / 2 + backoff / 2 * jitter);
+		};
+		const rearmDelay = Effect.fn("ThreadMaintenance.rearmDelay")(function* (progressed, priorStalls) {
+			return progressed ? config.alarmBackoffBase : backoffDelay(priorStalls, yield* Random.next);
+		});
+		const rearmFailure = Effect.fn("ThreadMaintenance.rearmFailure")(function* (observed) {
+			const { generation, nativeOnly } = observed;
+			if (generation === void 0) return;
+			yield* failpoint.hit("maintenance:retry:before");
+			yield* mutations.withSnapshot((active) => Effect.gen(function* () {
+				const deadline = yield* pendingDeadline.pipe(Effect.catchCause(() => Effect.succeed(Option.none())));
+				const now = yield* Clock.currentTimeMillis;
+				const jitter = yield* Random.next;
+				yield* runTransaction("back off failed maintenance", () => ctx.storage.transaction(async (transaction) => {
+					const { state } = await readMaintenanceState(transaction);
+					const previous = state.retry?.generation === generation ? state.retry : void 0;
+					const retry = MaintenanceRetry.make({
+						generation,
+						notBefore: Math.max(previous?.notBefore ?? 0, now + backoffDelay(previous?.stalls ?? 0, jitter)),
+						nativeOnly,
+						stalls: Math.min(30, (previous?.stalls ?? 0) + 1)
+					});
+					await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+						...state,
+						retry
+					})));
+					const nativeDeadline = active > 0 || state.dirty !== generation ? now + minimumAlarmDelay : retry.notBefore;
+					await transaction.setAlarm(Math.max(now + minimumAlarmDelay, Option.isSome(deadline) && (nativeOnly || deadline.value > now) ? Math.min(nativeDeadline, deadline.value) : nativeDeadline));
+				}));
+			}));
+			yield* failpoint.hit("maintenance:retry:after");
 		});
-		const pass = Effect.fn("ThreadMaintenance.pass")(function* (yieldAfter) {
+		const pass = Effect.fn("ThreadMaintenance.pass")(function* (yieldAfter, dispatchUntil, observed) {
 			const annotate = (report) => Effect.annotateCurrentSpan({
 				phase: report.phase,
 				recovered: report.recovered,
@@ -313,32 +365,49 @@ var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effe
 				alarm: report.alarm
 			}).pipe(Effect.as(report));
 			const started = yield* mutations.withSnapshot((activeAtStart) => Effect.gen(function* () {
-				const generation = yield* beginPass();
+				const generation = yield* beginPass(observed);
 				if (generation._tag === "Actionable" && activeAtStart === 0) yield* publication.prepareGeneration(generation.generation);
 				return {
 					...generation,
 					activeAtStart
 				};
 			}));
-			const deliveryFinished = yield* Deferred.make();
-			const delivery = yield* Effect.forkChild(messages.drainUntil?.(deliveryFinished) ?? messages.drain);
-			const hostWork = yield* Effect.forkChild(host.drainUntil(deliveryFinished));
-			const finishDelivery = Deferred.succeed(deliveryFinished, void 0).pipe(Effect.andThen(Fiber.awaitAll([delivery, hostWork])), Effect.flatMap((outcomes) => Effect.forEach(outcomes, (outcome) => outcome, { discard: true })));
-			const projected = yield* Effect.exit(drainDue.pipe(Effect.provideService(ThreadProjectionMaintenance, projection)));
-			if (Exit.isFailure(projected) && Cause.hasInterrupts(projected.cause)) return yield* Effect.failCause(projected.cause);
+			const auxiliaryScope = yield* Effect.acquireRelease(Scope.make("parallel"), (scope, exit) => Scope.close(scope, exit));
+			const sourceFinished = yield* Deferred.make();
+			const finished = Deferred.await(sourceFinished);
+			const deliveryFiber = yield* Effect.forkIn(Scope.provide(auxiliaryScope)(messages.drainUntil(finished, dispatchUntil)), auxiliaryScope);
+			const hostFiber = yield* Effect.forkIn(Scope.provide(auxiliaryScope)(Effect.gen(function* () {
+				yield* Schema.decodeEffect(AuxiliaryDispatchMillis)(host.dispatchTimeoutMillis).pipe(Effect.mapError((cause) => DurableAlarmError.make({
+					operation: "host dispatch allowance",
+					message: "Declare an integer whole-wave allowance between 1 and 300000 milliseconds",
+					cause
+				})));
+				yield* host.drainUntil(finished, dispatchUntil);
+			})), auxiliaryScope);
+			const backfill = yield* Effect.forkIn(drainDue.pipe(Effect.provideService(ThreadProjectionMaintenance, projection), Effect.timeoutOption(config.projectionDispatchTimeoutMillis)), auxiliaryScope);
+			const finishAuxiliary = Effect.gen(function* () {
+				yield* Deferred.succeed(sourceFinished, void 0);
+				const remaining = Math.max(1, DateTime.toEpochMillis(dispatchUntil) - (yield* Clock.currentTimeMillis));
+				const hostJoin = yield* Effect.forkIn(Fiber.join(hostFiber).pipe(Effect.timeoutOption(Math.min(host.dispatchTimeoutMillis, remaining)), Effect.tap((result) => Effect.annotateCurrentSpan({ "host.timedOut": Option.isNone(result) }))), auxiliaryScope);
+				yield* Fiber.joinAll([
+					deliveryFiber,
+					hostJoin,
+					backfill
+				]);
+				yield* Scope.close(auxiliaryScope, Exit.void);
+			});
 			const deadline = yield* publication.pendingDeadline;
 			if (started._tag === "Actionable" || Option.isSome(deadline) && deadline.value <= (yield* Clock.currentTimeMillis)) yield* publication.drain;
 			const pending = yield* publication.pendingDeadline;
 			if (started._tag === "CaughtUp" || Option.isSome(pending)) {
-				yield* finishDelivery;
-				if (Exit.isFailure(projected)) return yield* Effect.failCause(projected.cause);
+				yield* finishAuxiliary;
 				yield* failpoint.hit("maintenance:finish:before");
 				const disposition = yield* mutations.withSnapshot((active) => Effect.gen(function* () {
 					const latest = yield* pendingDeadline;
 					const now = yield* Clock.currentTimeMillis;
 					return yield* runTransaction("finish publication pass", () => ctx.storage.transaction(async (transaction) => {
 						const { state } = await readMaintenanceState(transaction);
-						const nativeDeadline = active > 0 || state.dirty > state.processed ? now + config.wakeScanInterval : Infinity;
+						const nativeDeadline = active > 0 || state.dirty > state.processed ? state.retry?.generation === state.dirty && active === 0 ? Math.max(now + minimumAlarmDelay, state.retry.notBefore) : now + config.wakeScanInterval : Infinity;
 						const next = Option.isSome(latest) ? Math.min(nativeDeadline, latest.value) : nativeDeadline;
 						if (Number.isFinite(next)) {
 							await transaction.setAlarm(Math.max(now + minimumAlarmDelay, next));
@@ -357,29 +426,70 @@ var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effe
 					alarm: disposition
 				}));
 			}
+			observed.nativeOnly = true;
 			const recovered = yield* runtime.runRecovery;
 			const reports = new Map(recovered.map((report) => [report.submissionId, report]));
 			const current = yield* Stream.runCollect(ledger.scanNonterminal);
 			const heads = /* @__PURE__ */ new Map();
 			for (const row of current) if (!heads.has(row.threadId)) heads.set(row.threadId, row);
 			const eligible = [...heads.values()].filter((head) => !stableExternalWait(head, reports)).map((head) => head.threadId).sort();
-			let selected = eligible[0];
-			if (heads.size > 1 && selected !== void 0) {
-				yield* failpoint.hit("maintenance:select:before");
-				selected = yield* runTransaction("select maintenance lane", () => ctx.storage.transaction(async (transaction) => {
-					const { state } = await readMaintenanceState(transaction);
-					const next = eligible.find((threadId) => state.lastServedThreadId === void 0 || threadId > state.lastServedThreadId) ?? eligible[0];
-					if (next !== void 0) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
-						...state,
-						lastServedThreadId: next
-					})));
-					return next;
-				}));
-				yield* failpoint.hit("maintenance:select:after");
+			const selectionTime = yield* Clock.currentTimeMillis;
+			yield* failpoint.hit("maintenance:select:before");
+			const selection = yield* runTransaction("select maintenance lane", () => ctx.storage.transaction(async (transaction) => {
+				const { state } = await readMaintenanceState(transaction);
+				const retries = (state.bindingRetries ?? []).filter((retry) => heads.get(retry.threadId)?.submissionId === retry.submissionId);
+				const runnable = eligible.filter((threadId) => !retries.some((retry) => retry.threadId === threadId && retry.notBefore > selectionTime));
+				const next = runnable.find((threadId) => state.lastServedThreadId === void 0 || threadId > state.lastServedThreadId) ?? runnable[0];
+				if (next !== void 0) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+					...state,
+					lastServedThreadId: next
+				})));
+				return {
+					selected: next,
+					retries
+				};
+			}));
+			yield* failpoint.hit("maintenance:select:after");
+			const selected = selection.selected === void 0 ? void 0 : heads.get(selection.selected);
+			let retries = selection.retries;
+			let bindingFailure;
+			const settlement = selected === void 0 ? Option.none() : yield* runtime.processThreadHead(selected.threadId, { yieldAfter }).pipe(Effect.catchTag(["BindingUnavailable", "BindingDigestMismatch"], (failure) => {
+				bindingFailure = failure;
+				return Effect.succeed(Option.none());
+			}));
+			if (selected !== void 0) {
+				const previous = retries.find((retry) => retry.submissionId === selected.submissionId);
+				let retry;
+				let reportBindingFailure = false;
+				if (bindingFailure !== void 0) {
+					const now = yield* Clock.currentTimeMillis;
+					const attempts = Math.min(30, (previous?.attempts ?? 0) + 1);
+					reportBindingFailure = previous === void 0 || now - previous.reportedAt >= 9e5;
+					retry = BindingRetry.make({
+						threadId: selected.threadId,
+						submissionId: selected.submissionId,
+						attempts,
+						notBefore: now + Math.min(6e4, 5e3 * 2 ** (attempts - 1)),
+						reportedAt: reportBindingFailure ? now : previous?.reportedAt ?? now
+					});
+				}
+				if (retry !== void 0 || previous !== void 0) {
+					yield* failpoint.hit("maintenance:binding-retry:before");
+					retries = yield* runTransaction("record submission binding retry", () => ctx.storage.transaction(async (transaction) => {
+						const { state } = await readMaintenanceState(transaction);
+						const bindingRetries = [...(state.bindingRetries ?? []).filter((entry) => entry.submissionId !== selected.submissionId), ...retry === void 0 ? [] : [retry]];
+						await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+							...state,
+							bindingRetries
+						})));
+						return bindingRetries;
+					}));
+					yield* failpoint.hit("maintenance:binding-retry:after");
+				}
+				if (bindingFailure !== void 0) yield* reportBindingFailure ? Effect.logError("Thread awaits a compatible binding; original work remains pending", Cause.fail(bindingFailure)) : Effect.logDebug("Thread binding retry remains pending", Cause.fail(bindingFailure));
 			}
-			const settlement = selected === void 0 ? Option.none() : yield* runtime.processThreadHead(selected, { yieldAfter });
-			yield* finishDelivery;
-			if (Exit.isFailure(projected)) return yield* Effect.failCause(projected.cause);
+			observed.nativeOnly = false;
+			yield* finishAuxiliary;
 			const remaining = yield* Stream.runCollect(ledger.scanNonterminal);
 			const waitingHeads = /* @__PURE__ */ new Map();
 			const autonomous = remaining.some((snapshot) => {
@@ -389,8 +499,11 @@ var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effe
 				return !stableExternalWait(snapshot, reports);
 			});
 			const progressed = Option.isSome(settlement) || recovered.some((report) => report.disposition === "repaired");
-			const delay = autonomous ? yield* rearmDelay(progressed) : 0;
 			const now = yield* Clock.currentTimeMillis;
+			const ordinaryDelay = autonomous ? yield* rearmDelay(progressed, started.stalls) : 0;
+			const nextEligible = eligible.map((threadId) => retries.find((retry) => retry.submissionId === heads.get(threadId)?.submissionId)?.notBefore ?? now);
+			const bindingDelay = nextEligible.length === 0 ? 0 : Math.max(0, Math.min(...nextEligible) - now);
+			const delay = Math.max(ordinaryDelay, bindingDelay);
 			yield* failpoint.hit("maintenance:finish:before");
 			const alarmDisposition = yield* mutations.withSnapshot((active) => Effect.gen(function* () {
 				const publicationDeadline = yield* pendingDeadline;
@@ -398,13 +511,21 @@ var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effe
 					const { state } = await readMaintenanceState(transaction);
 					const processed = autonomous || started.activeAtStart > 0 || active > 0 ? state.processed : state.processed > started.generation ? state.processed : started.generation;
 					const next = ThreadMaintenanceState.make({
-						...state,
+						...Struct.omit(state, ["retry"]),
 						processed,
-						nonterminal: remaining.length
+						nonterminal: remaining.length,
+						bindingRetries: (state.bindingRetries ?? []).filter((retry) => remaining.some((row) => row.submissionId === retry.submissionId)),
+						...autonomous && !progressed ? { retry: MaintenanceRetry.make({
+							generation: started.generation,
+							notBefore: now + delay,
+							nativeOnly: true,
+							stalls: Math.min(30, started.stalls + 1)
+						}) } : {}
 					});
 					await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
 					if (autonomous) {
-						await transaction.setAlarm(Option.isSome(publicationDeadline) ? Math.max(now + minimumAlarmDelay, Math.min(now + delay, publicationDeadline.value)) : now + delay);
+						const nativeDeadline = started.activeAtStart > 0 || active > 0 || state.dirty !== started.generation ? now + minimumAlarmDelay : now + delay;
+						await transaction.setAlarm(Option.isSome(publicationDeadline) ? Math.max(now + minimumAlarmDelay, Math.min(nativeDeadline, publicationDeadline.value)) : nativeDeadline);
 						return "rearmed";
 					}
 					if (started.activeAtStart > 0 || active > 0 || next.dirty > next.processed) {
@@ -420,7 +541,6 @@ var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effe
 				}));
 			}));
 			yield* failpoint.hit("maintenance:finish:after");
-			if (alarmDisposition === "cleared") yield* Ref.set(stalls, 0);
 			return yield* annotate(MaintenancePassReport.make({
 				phase: "actionable",
 				recovered: recovered.length,
@@ -431,8 +551,11 @@ var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effe
 		});
 		return ThreadMaintenance.of({
 			pass: Effect.gen(function* () {
-				const yieldAfter = DateTime.makeUnsafe((yield* Clock.currentTimeMillis) + 6e5);
-				return yield* alarm.withWakesDeferred(maintenancePassGate.withPermit(pass(yieldAfter)));
+				const now = yield* Clock.currentTimeMillis;
+				const yieldAfter = DateTime.makeUnsafe(now + 6e5);
+				const dispatchUntil = DateTime.makeUnsafe(now + 84e4);
+				const observed = { nativeOnly: false };
+				return yield* alarm.withWakesDeferred(maintenancePassGate.withPermit(Effect.scoped(pass(yieldAfter, dispatchUntil, observed)).pipe(Effect.onErrorIf(() => true, () => rearmFailure(observed)))));
 			}).pipe(Effect.timeoutOrElse({
 				duration: "14 minutes",
 				orElse: () => DurableAlarmError.make({